@vibecodemax/cli 0.1.8 → 0.1.10

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { checkS3Context, setupS3Storage } from "./storageS3.js";
 const SETUP_STATE_PATH = path.join(".vibecodemax", "setup-state.json");
@@ -32,6 +32,10 @@ const STRIPE_EVENTS = [
     "invoice.payment_succeeded",
     "invoice.payment_failed",
 ];
+const CONCURRENTLY_VERSION = "^9.2.1";
+const TRIGGER_DEV_ALL_SCRIPT = 'concurrently -k -n app,jobs -c cyan,yellow "npm run dev" "npm run trigger:dev"';
+const TRIGGER_STRIPE_DEV_ALL_SCRIPT = 'concurrently -k -n app,jobs,payments -c cyan,yellow,magenta "npm run dev" "npm run trigger:dev" "npm run stripe:listen"';
+const STRIPE_ONLY_DEV_ALL_SCRIPT = 'concurrently -k -n app,payments -c cyan,magenta "npm run dev" "npm run stripe:listen"';
 const LEMON_EVENTS = [
     "order_created",
     "subscription_created",
@@ -651,6 +655,13 @@ function getSupabaseRunner(dependencyManager) {
         return "yarn supabase";
     return "npx supabase";
 }
+function getDependencyInstallCommand(dependencyManager, packageName) {
+    if (dependencyManager === "pnpm")
+        return `pnpm add -D ${packageName}`;
+    if (dependencyManager === "yarn")
+        return `yarn add -D ${packageName}`;
+    return `npm install --save-dev ${packageName}`;
+}
 function runShellCommand(command, cwd) {
     const result = spawnSync(process.env.SHELL || "/bin/zsh", ["-lc", command], {
         cwd,
@@ -679,6 +690,17 @@ function runLinkedSupabaseCommand(command, cwd, failureCode, fallbackMessage) {
     }
     return typeof result.stdout === "string" ? result.stdout.trim() : "";
 }
+function ensureStripeCliInstalled(cwd) {
+    const result = spawnSync(process.env.SHELL || "/bin/zsh", ["-lc", "stripe --version"], {
+        cwd,
+        env: process.env,
+        encoding: "utf8",
+    });
+    if (result.status !== 0) {
+        fail("STRIPE_CLI_MISSING", "Stripe CLI is not installed. Install it from https://docs.stripe.com/stripe-cli/install before continuing Stripe localhost setup.");
+    }
+    return typeof result.stdout === "string" ? result.stdout.trim() : "";
+}
 function isMigrationOrderingConflict(message) {
     return /Found local migration files to be inserted before the last migration on remote database\./i.test(message);
 }
@@ -1016,15 +1038,140 @@ function requireWebhookUrl(value, expectedPath, provider) {
     }
     try {
         const parsed = new URL(trimmed);
-        if (parsed.protocol !== "https:" || parsed.pathname !== expectedPath) {
-            fail("INVALID_WEBHOOK_URL", `${provider} webhook URL must be an https URL ending in ${expectedPath}.`);
+        const isHttps = parsed.protocol === "https:";
+        const isLocalhost = parsed.protocol === "http:" && parsed.hostname === "localhost";
+        if ((!isHttps && !isLocalhost) || parsed.pathname !== expectedPath) {
+            fail("INVALID_WEBHOOK_URL", `${provider} webhook URL must be an https URL ending in ${expectedPath}, or http://localhost ending in ${expectedPath}.`);
         }
     }
     catch {
-        fail("INVALID_WEBHOOK_URL", `${provider} webhook URL must be a valid https URL ending in ${expectedPath}.`);
+        fail("INVALID_WEBHOOK_URL", `${provider} webhook URL must be a valid https URL ending in ${expectedPath}, or http://localhost ending in ${expectedPath}.`);
     }
     return trimmed;
 }
+function requirePackageJson(cwd) {
+    const packageJsonPath = path.join(cwd, "package.json");
+    if (!fs.existsSync(packageJsonPath)) {
+        fail("MISSING_PACKAGE_JSON", "package.json is missing in the project root.");
+    }
+    try {
+        const parsed = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            fail("INVALID_PACKAGE_JSON", "package.json must contain a JSON object.");
+        }
+        return { packageJsonPath, packageJson: parsed };
+    }
+    catch {
+        fail("INVALID_PACKAGE_JSON", "package.json is not valid JSON.");
+    }
+}
+function writePackageJson(packageJsonPath, packageJson) {
+    fs.writeFileSync(packageJsonPath, `${JSON.stringify(packageJson, null, 2)}\n`, "utf8");
+}
+function buildStripeListenScript(localhostUrl) {
+    return `stripe listen --events ${STRIPE_EVENTS.join(",")} --forward-to ${localhostUrl}/api/webhooks/stripe`;
+}
+function ensureStripeLocalScripts(cwd, dependencyManager, localhostUrl) {
+    const { packageJsonPath, packageJson } = requirePackageJson(cwd);
+    const scripts = packageJson.scripts && typeof packageJson.scripts === "object" && !Array.isArray(packageJson.scripts)
+        ? { ...packageJson.scripts }
+        : {};
+    const devDependencies = packageJson.devDependencies && typeof packageJson.devDependencies === "object" && !Array.isArray(packageJson.devDependencies)
+        ? { ...packageJson.devDependencies }
+        : {};
+    const dependencies = packageJson.dependencies && typeof packageJson.dependencies === "object" && !Array.isArray(packageJson.dependencies)
+        ? packageJson.dependencies
+        : {};
+    const stripeListenScript = buildStripeListenScript(localhostUrl);
+    const changedScripts = [];
+    let installConcurrently = false;
+    if (scripts["stripe:listen"] !== stripeListenScript) {
+        scripts["stripe:listen"] = stripeListenScript;
+        changedScripts.push("stripe:listen");
+    }
+    const currentDevAll = typeof scripts["dev:all"] === "string" ? scripts["dev:all"] : "";
+    if (!currentDevAll) {
+        scripts["dev:all"] = STRIPE_ONLY_DEV_ALL_SCRIPT;
+        changedScripts.push("dev:all");
+        if (!isNonEmptyString(devDependencies.concurrently) && !isNonEmptyString(dependencies.concurrently)) {
+            devDependencies.concurrently = CONCURRENTLY_VERSION;
+            installConcurrently = true;
+        }
+    }
+    else if (currentDevAll === TRIGGER_DEV_ALL_SCRIPT) {
+        scripts["dev:all"] = TRIGGER_STRIPE_DEV_ALL_SCRIPT;
+        changedScripts.push("dev:all");
+    }
+    else if (currentDevAll === STRIPE_ONLY_DEV_ALL_SCRIPT || currentDevAll === TRIGGER_STRIPE_DEV_ALL_SCRIPT) {
+        // already configured
+    }
+    else if (currentDevAll.includes("npm run stripe:listen")) {
+        // preserve user-updated script if Stripe listener is already included
+    }
+    else {
+        fail("DEV_ALL_CONFLICT", "package.json already defines dev:all in an unexpected shape. Update it manually to include npm run stripe:listen, or reset it to the generated Trigger pattern before retrying.");
+    }
+    packageJson.scripts = scripts;
+    if (Object.keys(devDependencies).length > 0) {
+        packageJson.devDependencies = devDependencies;
+    }
+    writePackageJson(packageJsonPath, packageJson);
+    if (installConcurrently) {
+        runShellCommand(getDependencyInstallCommand(dependencyManager, "concurrently"), cwd);
+    }
+    return {
+        changedScripts,
+        installConcurrently,
+        scripts,
+    };
+}
+function waitForStripeListenSecret(command, cwd) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(process.env.SHELL || "/bin/zsh", ["-lc", command], {
+            cwd,
+            env: process.env,
+            stdio: ["ignore", "pipe", "pipe"],
+            detached: true,
+        });
+        let buffer = "";
+        let settled = false;
+        const timeoutId = setTimeout(() => {
+            if (!settled) {
+                finish(new Error("Timed out waiting for Stripe CLI to print a webhook signing secret."));
+            }
+        }, 15000);
+        const finish = (error, secret = "") => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeoutId);
+            try {
+                process.kill(-child.pid, "SIGTERM");
+            }
+            catch { }
+            if (error)
+                reject(error);
+            else
+                resolve(secret);
+        };
+        const inspectChunk = (chunk) => {
+            buffer += typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
+            const match = buffer.match(/whsec_[A-Za-z0-9]+/);
+            if (match) {
+                finish(null, match[0]);
+            }
+        };
+        child.stdout?.on("data", inspectChunk);
+        child.stderr?.on("data", inspectChunk);
+        child.on("error", (error) => finish(error));
+        child.on("close", (code) => {
+            if (!settled) {
+                const message = buffer.trim() || `stripe listen exited with code ${String(code ?? "")}`.trim();
+                finish(new Error(message || "Failed to capture Stripe webhook signing secret from stripe listen."));
+            }
+        });
+    });
+}
 function formEncode(value, prefix = "") {
     const entries = [];
     if (Array.isArray(value)) {
@@ -1045,6 +1192,14 @@ function formEncode(value, prefix = "") {
     return entries;
 }
 async function stripeRequest(params) {
+    const { response, json } = await stripeRequestWithResponse(params);
+    if (!response.ok) {
+        const message = extractErrorMessage(json?.error) || extractErrorMessage(json) || `Stripe returned ${response.status}`;
+        fail("STRIPE_API_ERROR", message, 1, { status: response.status });
+    }
+    return json;
+}
+async function stripeRequestWithResponse(params) {
     const url = new URL(`https://api.stripe.com${params.path}`);
     if (params.query) {
         for (const [key, value] of formEncode(params.query)) {
@@ -1065,11 +1220,7 @@ async function stripeRequest(params) {
         body,
     });
     const json = await response.json().catch(() => null);
-    if (!response.ok) {
-        const message = extractErrorMessage(json?.error) || extractErrorMessage(json) || `Stripe returned ${response.status}`;
-        fail("STRIPE_API_ERROR", message, 1, { status: response.status });
-    }
-    return json;
+    return { response, json };
 }
 async function lemonRequest(params) {
     const url = new URL(`https://api.lemonsqueezy.com/v1${params.path}`);
@@ -1145,6 +1296,30 @@ function checkStripeKeys(flags) {
         checks: ["presence", "format", "mode_consistency"],
     });
 }
+function checkStripeCli() {
+    const version = ensureStripeCliInstalled(process.cwd());
+    printJson({
+        ok: true,
+        command: "payments check-stripe-cli",
+        ready: true,
+        version,
+    });
+}
+function loginStripeCli(flags) {
+    const { values } = loadLocalEnv();
+    ensureStripeCliInstalled(process.cwd());
+    const authMode = readStringFlag(flags, "auth-mode") === "api_key" ? "api_key" : "tty";
+    const command = authMode === "api_key"
+        ? `stripe login --api-key ${shellQuote(requireEnvValue(values, "STRIPE_SECRET_KEY", ".env.local"))}`
+        : "stripe login";
+    runShellCommand(command, process.cwd());
+    printJson({
+        ok: true,
+        command: "payments login-stripe-cli",
+        authMode,
+        authenticated: true,
+    });
+}
 function checkLemonKeys(flags) {
     const { values } = loadLocalEnv();
     const mode = normalizePaymentsMode(readStringFlag(flags, "mode"));
@@ -1208,7 +1383,7 @@ async function createStripeWebhook(flags) {
         });
         return;
     }
-    const created = await stripeRequest({
+    const createdResponse = await stripeRequestWithResponse({
         secretKey,
         method: "POST",
         path: "/v1/webhook_endpoints",
@@ -1218,6 +1393,16 @@ async function createStripeWebhook(flags) {
             description: "VibeCodeMax payments webhook",
         },
     });
+    if (!createdResponse.response.ok) {
+        const errorMessage = extractErrorMessage(createdResponse.json?.error)
+            || extractErrorMessage(createdResponse.json)
+            || `Stripe returned ${createdResponse.response.status}`;
+        if (/activate|activation|business details|submit.*business/i.test(errorMessage)) {
+            fail("STRIPE_ACCOUNT_NOT_ACTIVATED", "Your Stripe account is not activated. Submit your business details in the Stripe dashboard before setting up live webhooks.", 1, { status: createdResponse.response.status });
+        }
+        fail("STRIPE_WEBHOOK_CREATE_FAILED", errorMessage, 1, { status: createdResponse.response.status });
+    }
+    const created = createdResponse.json;
     if (!isStripeWebhookSecret(created.secret)) {
         fail("STRIPE_WEBHOOK_CREATE_FAILED", "Stripe did not return a webhook signing secret.");
     }
@@ -1236,6 +1421,40 @@ async function createStripeWebhook(flags) {
         envWritten: ["STRIPE_WEBHOOK_SECRET"],
     });
 }
+async function setupStripeLocalhost(flags) {
+    const cwd = process.cwd();
+    const dependencyManager = detectDependencyManager(cwd, flags);
+    const localhostUrl = normalizeLocalUrl(readStringFlag(flags, "localhost-url"));
+    const { envLocalPath, values } = loadLocalEnv(cwd);
+    const secretKey = values.STRIPE_SECRET_KEY;
+    if (!isStripeSecretKey(secretKey) || !secretKey.startsWith("sk_test_")) {
+        fail("INVALID_PAYMENTS_ENV", "STRIPE_SECRET_KEY must be a Stripe test secret key in .env.local for localhost Stripe setup.");
+    }
+    ensureStripeCliInstalled(cwd);
+    const scriptResult = ensureStripeLocalScripts(cwd, dependencyManager, localhostUrl);
+    const listenCommand = `stripe listen --api-key ${shellQuote(secretKey.trim())} --events ${STRIPE_EVENTS.join(",")} --forward-to ${localhostUrl}/api/webhooks/stripe`;
+    let signingSecret = "";
+    try {
+        signingSecret = await waitForStripeListenSecret(listenCommand, cwd);
+    }
+    catch (error) {
+        fail("STRIPE_LOCALHOST_SETUP_FAILED", error instanceof Error ? error.message : "Failed to capture Stripe localhost webhook signing secret.");
+    }
+    mergeEnvFile(envLocalPath, {
+        STRIPE_WEBHOOK_SECRET: signingSecret,
+    });
+    printJson({
+        ok: true,
+        command: "payments setup-stripe-localhost",
+        localhostUrl,
+        webhookUrl: `${localhostUrl}/api/webhooks/stripe`,
+        scriptsChanged: scriptResult.changedScripts,
+        installConcurrently: scriptResult.installConcurrently,
+        devAllScript: typeof scriptResult.scripts["dev:all"] === "string" ? scriptResult.scripts["dev:all"] : null,
+        stripeListenScript: typeof scriptResult.scripts["stripe:listen"] === "string" ? scriptResult.scripts["stripe:listen"] : null,
+        envWritten: ["STRIPE_WEBHOOK_SECRET"],
+    });
+}
 function checkStripeWebhookSecret(flags) {
     const { values } = loadLocalEnv();
     const mode = normalizePaymentsMode(readStringFlag(flags, "mode"));
@@ -1389,6 +1608,9 @@ async function main() {
                 "storage check-s3-context",
                 "storage setup-s3",
                 "payments check-stripe-keys",
+                "payments check-stripe-cli",
+                "payments login-stripe-cli",
+                "payments setup-stripe-localhost",
                 "payments create-stripe-webhook",
                 "payments check-stripe-webhook-secret",
                 "payments check-lemonsqueezy-keys",
@@ -1422,6 +1644,12 @@ async function main() {
         return setupS3Storage(flags);
     if (command === "payments" && subcommand === "check-stripe-keys")
         return checkStripeKeys(flags);
+    if (command === "payments" && subcommand === "check-stripe-cli")
+        return checkStripeCli();
+    if (command === "payments" && subcommand === "login-stripe-cli")
+        return loginStripeCli(flags);
+    if (command === "payments" && subcommand === "setup-stripe-localhost")
+        return setupStripeLocalhost(flags);
     if (command === "payments" && subcommand === "create-stripe-webhook")
         return createStripeWebhook(flags);
     if (command === "payments" && subcommand === "check-stripe-webhook-secret")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibecodemax/cli",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "VibeCodeMax CLI — local provider setup for bootstrap and project configuration",
   "type": "module",
   "bin": {